Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

RPC - HTTPS Exchange config problem

Posted on 2006-11-29
14
Medium Priority
?
1,016 Views
Last Modified: 2007-12-19
Windows 2003 LAN; DC and EXCHANGE on separate boxes; no separate front-end Exchange.

Configured everything according to:

http://www.amset.info/exchange/rpc-http-server.asp

outlook /rpcdiag shows that we are NOT connecting over https, even in the LAN

https://mail.domain.com/rpc prompts for credentials WITHOUT a certificate error, so we believe the certificate is doing just fine.

On exchange, the rpcproxy \ Validports registry entry (names have been changed to protect the innocent):

exchange:100-5000;exchange:6001-6002;exchange.domain.com:6001-6002;dc:6001-6002;dc.domain.com:6001-6002;exchange:6004;exchange.domain.com:6004;dc:6004;dc.domain.com:6004;mail.domain.com:6001-6002;mail.domain.com:6004;dc:593;dc.domain.com:593;exchange:593;exchange.domain.com:593;mail.domain.com:593

mail.domain.com is external name
exchange and exchange.domain.com are internal names
(note domain.com is the same internal and external, but shouldn't be a problem to get internal working)


Had trouble with this reg entry until I found "rpccfg /hd" which helped identify an extra semi-colon.
rpccfg /hd works now with expected results.  Not sure though whether this box would still need a restart for the registry change to 'take' otherwise when rpccfg /hd yields the expected results.

I'm thinking the next steps are troubleshooting using rpcping

Not sure the switches that would be best to use, but running from a client I get:
Exception 5 (0x00000005)

running it on the server I get:
Completed 1 calls in 1 ms
1000 T/S or   1.000 ms/T

Please HELP!
0
Comment
Question by:greenshire
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 5
14 Comments
 

Author Comment

by:greenshire
ID: 18038347
ok, trying the s switch, it works from a client machine:

C:\>rpcping -s churchill
Completed 1 calls in 16 ms
62 T/S or  16.000 ms/T
0
 
LVL 104

Expert Comment

by:Sembee
ID: 18038681
Have you made the registry change on the domain controller?

Simon.
0
 

Author Comment

by:greenshire
ID: 18039023
You mean the "NSPI Interface protocol sequences"?
Yes, the entry is:    ncacn_http:6004
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
LVL 104

Expert Comment

by:Sembee
ID: 18040677
Annoying, this feature either works or it doesn't.

In my experience it comes down to one of three things wrong.

1. SSL certificate errors.
2. Authentication settings.
3. Registry settings.

On the authentication issue, in IIS Manager find the /rpc virtual directory and ensure that just integrated and basic authentication is enabled. It should not have anonymous or anything else enabled.

The registry settings are easily broken by a single ; in the wrong place. I will often rip the entire set out and replace them to ensure that it is set correctly.

Simon.
0
 

Author Comment

by:greenshire
ID: 18045400
SSL is working because we can get the prompt for credentials without certificate warnings.

I verified that IIS virtual directory is configured correctly, specifically integrated and basic authen.


rpccfg on exchange shows me that the registry is taking:

C:\>rpccfg /hd
Server Name                         Port Settings
----------------------------------------------------------------------
dc                                 593 6001-6002 6004
dc.domain.com               593 6001-6002 6004
exchange                       100-5000 593 6001-6002 6004
exchange.domain.com     593 6001-6002 6004
mail.domain.com            593 6001-6002 6004

Now the rpccfg only showed me that the registry settings worked as of a change I made yesterday.  Might the server still need a reboot for those ports to actually work (not just for the rpccfg utility)?

What else can I use to test where this might be broken?
0
 
LVL 104

Expert Comment

by:Sembee
ID: 18047318
A reboot technically shouldn't be required.
However if you find that it isn't working, then there is no harm in rebooting the server to see if the changes therefore "take". As I put above, this feature either works or it doesn't, and when it doesn't, trying to find why is very difficult.

Simon.
0
 

Author Comment

by:greenshire
ID: 18047363
While I am waiting for the opportunity to reboot, what can I test to rule out problems and how?  All three breakpoints that you mentioned above seem to be in order.
0
 
LVL 104

Expert Comment

by:Sembee
ID: 18050665
There isn't a lot else that you can do. It either works or it doesn't. Until you can reboot you will not know whether that will be the fix or not.

Simon.
0
 

Author Comment

by:greenshire
ID: 18077795
OK, reboot availed nothing new.  
tried switching to the other DC, same result.  

I tried the rpcping utility and rpc seems to be functioning at one level, but when I start using some of the switches for the rpcping command, it starts throwing errors.

What else can we try to identify where the problem is?
0
 
LVL 104

Expert Comment

by:Sembee
ID: 18081330
Remove everything and start again. I have done that on more than one occasion. Remove the RPC Proxy service and then reinstall it and do the registry settings from scratch. You start going round in circles otherwise.

Simon.
0
 

Author Comment

by:greenshire
ID: 18085634
I called Microsoft.  We removed the rpcproxy service and re-added, but no change.  

The symptoms when we browsed the rpcproxy.dll pointed the technician to the web service extensions.  We manually ripped out the 'required files' entry there and entered the path to the dll on level deeper, into the system32/rpcproxy folder instead of just the system32 folder.  It now works wonderfully!
0
 

Author Comment

by:greenshire
ID: 18086124
Our resolution can be found within this kb artilce - http://support.microsoft.com/kb/919092 
STEP 2 was our solution.

thank you for your help!
0
 
LVL 1

Accepted Solution

by:
DarthMod earned 0 total points
ID: 18221515
PAQd, 500 points refunded.

DarthMod
CS Moderator
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In-place Upgrading Dirsync to Azure AD Connect
One-stop solution for Exchange Administrators to address all MS Exchange Server issues, which is known by the name of Stellar Exchange Toolkit.
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
This video discusses moving either the default database or any database to a new volume.

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question